CVE-2024-1927: Student Clearance System SQLi Vulnerability

CVE-2024-1927 Overview

A critical SQL Injection vulnerability has been identified in SourceCodester Web-Based Student Clearance System version 1.0. The vulnerability exists in the /Admin/login.php file, where improper handling of the txtpassword parameter allows attackers to inject malicious SQL commands. This flaw enables remote attackers to bypass authentication, extract sensitive data, modify database contents, or potentially gain complete control over the underlying database system.

Critical Impact

This SQL Injection vulnerability allows unauthenticated remote attackers to completely compromise the database backend of the Web-Based Student Clearance System, potentially exposing sensitive student records, administrative credentials, and enabling full database manipulation.

Affected Products

• Web-Based Student Clearance System 1.0 by walterjnr1
• SourceCodester Web-Based Student Clearance System deployments using /Admin/login.php
• Systems utilizing the vulnerable txtpassword authentication parameter

Discovery Timeline

• 2024-02-29 - CVE-2024-1927 published to NVD
• 2024-12-18 - Last updated in NVD database

Technical Details for CVE-2024-1927

Vulnerability Analysis

This vulnerability affects the administrative login functionality of the Web-Based Student Clearance System. The /Admin/login.php endpoint fails to properly sanitize user-supplied input in the txtpassword parameter before incorporating it into SQL queries. This classic SQL Injection flaw allows attackers to manipulate the authentication logic by injecting crafted SQL statements.

The vulnerability is particularly severe because it targets the authentication mechanism, meaning successful exploitation can grant attackers administrative access without valid credentials. The exploit has been publicly disclosed, increasing the risk of widespread exploitation against unpatched systems.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries in the login authentication mechanism. The application directly concatenates user input from the txtpassword field into SQL queries without proper sanitization or the use of prepared statements. This violates secure coding practices and creates a direct pathway for SQL Injection attacks.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which occurs when software constructs SQL commands using externally-influenced input without properly sanitizing special characters.

Attack Vector

The attack can be launched remotely over the network without requiring authentication or user interaction. An attacker can craft malicious input containing SQL syntax and submit it through the password field of the administrative login form. Common exploitation techniques include:

The attack leverages the network-accessible login form at /Admin/login.php. Attackers can submit specially crafted payloads through the txtpassword parameter to manipulate the underlying SQL query logic. Typical SQL Injection payloads such as single quotes, boolean-based conditions, and UNION-based queries can be used to bypass authentication or extract database contents.

For detailed technical information about the exploitation mechanism, refer to the GitHub PoC Repository and VulDB #254863.

Detection Methods for CVE-2024-1927

Indicators of Compromise

• Unusual login attempts to /Admin/login.php with SQL syntax patterns in request parameters
• Database error messages appearing in web server logs or application responses
• Unexpected database queries containing UNION, SELECT, OR, AND operators in authentication contexts
• Multiple failed login attempts followed by successful authentication from the same IP address
• Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL Injection patterns targeting the login endpoint
• Monitor web server access logs for requests to /Admin/login.php containing suspicious characters such as single quotes, double dashes, or SQL keywords
• Deploy database activity monitoring to detect anomalous query patterns originating from the web application
• Configure intrusion detection systems (IDS) with SQL Injection signature rules

Monitoring Recommendations

• Enable detailed logging for all authentication attempts to the administrative interface
• Set up alerts for database errors that may indicate SQL Injection attempts
• Monitor for unusual database query execution times that could indicate exploitation
• Track and alert on multiple failed authentication attempts from single source IPs

How to Mitigate CVE-2024-1927

Immediate Actions Required

• Restrict network access to the /Admin/login.php endpoint using firewall rules or IP whitelisting
• Deploy a Web Application Firewall (WAF) with SQL Injection protection rules in front of the application
• Consider taking the administrative login interface offline until a patch is applied
• Review database logs for signs of prior exploitation and rotate any potentially compromised credentials

Patch Information

No official vendor patch has been identified for this vulnerability. The Web-Based Student Clearance System is distributed through SourceCodester, and users should monitor the project repository and VulDB #254863 for updates. Given the critical nature of this vulnerability and the lack of official remediation, organizations should consider implementing secure coding fixes independently or migrating to an alternative solution.

Workarounds

• Implement prepared statements with parameterized queries in the /Admin/login.php file to prevent SQL Injection
• Add input validation to reject any SQL syntax characters in the txtpassword parameter
• Deploy network segmentation to limit access to the administrative interface from trusted networks only
• Use a reverse proxy or WAF to filter malicious requests before they reach the application

# Example: Apache .htaccess to restrict admin access by IP
<Files "login.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>